JP6049490B2 - Network analysis apparatus, network analysis method and program - Google Patents

Description

  The present invention relates to a network analysis device, a network analysis method, and a program.

  In recent years, building management systems that comprehensively manage, monitor, and control equipment such as air conditioners and illuminators installed in buildings are well known. In this type of building management system, generally, a central monitoring device connected to an upper network controls a plurality of facility devices connected to the lower network via a gateway (for example, Patent Document 1).

  In general, the central monitoring device, the gateway device, and each facility device constituting the building management system are provided from different vendors. Each vendor can fully perform the operation confirmation test of the device itself provided by itself, but it is not easy to perform the operation confirmation test that fully covers the situation after the system is actually constructed. Absent.

  For this reason, there are many cases where unexpected problems occur after the system is constructed and actually operated. It is necessary to collect and analyze the messages flowing through In other words, it is necessary to investigate what kind of events are occurring in the upper network and the lower network, and how the respective causal relationships are.

JP 2006-129283 A

  By the way, in a building management system with a lot of equipment to be managed, there are cases where a plurality of lower networks are constructed and each equipment connected to each lower network is controlled via an extension gateway corresponding to each lower network. Not a few.

  However, with this type of technology in the past, telegrams of a plurality of networks are collected separately. Therefore, there is a problem that the worker needs to perform the work of associating the collected messages of each network, which is very troublesome.

  The present invention has been made to solve the above-described conventional problems, and an object of the present invention is to provide a network analysis device that collects and associates messages flowing on at least three different networks.

In order to achieve the above object, a network analysis device according to the present invention includes:
A device for analyzing a network in a system including a first gateway device and a second gateway device,
A first message collection means for collecting a first message that is connected to the first network to which the first gateway device is connected and flows on the first network;
A second telegram collecting means for collecting a second telegram that is connected to the second network to which the first gateway device and the second gateway device are connected and flows on the second network;
A third message collection means for collecting a third message that is connected to the third network to which the second gateway device is connected and flows on the third network;
A mapping table in which a correspondence relationship between the first electronic message input to the first gateway device and the third electronic message output from the second gateway device is defined;
Referring to the mapping table, the first telegram collected by the first telegram collection unit is associated with the third telegram collected by the third telegram collection unit, and the associated first Based on the collection time of each of the electronic message and the third electronic message, the associated first electronic message and the third electronic message are further associated with the second electronic message collected by the second electronic message collecting means. And a message association means.

  According to the present invention, since the messages flowing on at least three different networks are collected and associated, it is possible to improve the efficiency of development and maintenance work in the equipment management system and the like.

It is a figure showing the whole equipment management system composition which incorporated a network analysis device concerning Embodiment 1 of the present invention. 1 is a block diagram illustrating a configuration of a network analysis device according to a first embodiment. (A) is a block diagram showing a configuration of a first message collection unit, (b) is a block diagram showing a configuration of a second message collection unit, and (c) is a third message collection. It is a block diagram which shows the structure of a part. FIG. 3 is a block diagram illustrating a configuration of a message association unit illustrated in FIG. 2. It is a figure which shows an example of a mapping table. It is a flowchart which shows the procedure of an electronic message correlation process. It is a figure for demonstrating extraction of intermediate message information. It is a block diagram which shows the structure of the message related part in the modification of the network analysis apparatus of Embodiment 1. FIG. It is a block diagram which shows the structure of the network analysis apparatus of Embodiment 2.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

(Embodiment 1)
FIG. 1 is a diagram showing an overall configuration of a facility management system incorporating a network analysis apparatus according to Embodiment 1 of the present invention. This equipment management system is a system (so-called building management system) that controls and manages equipment such as air conditioners and illuminators installed in a building. As shown in FIG. , Central monitoring device 20, gateway device 30, a plurality of extended gateway devices 40 (40A, 40B,...), And a plurality of facility devices 50 (50A ₁ , 50A ₂ , 50A ₃ ,..., 50B ₁ , 50B ₂ , 50B ₃ ,...).

  The central monitoring device 20 and the gateway device 30 are connected to a first network 60 that is a higher-level network conforming to a communication protocol such as BACnet (A Data Communication Protocol for Building Automation and Control Networks). The gateway device 30 and each extended gateway device 40 (40A, 40B,...) Are connected to the second network 70.

Further, each extended gateway device 40 is connected to a corresponding third network 80 (80A, 80B,...). The third network 80 is a lower network that conforms to a communication protocol unique to the vendor that provides the equipment 50. In the present embodiment, a plurality of facility devices 50A (50A ₁ , 50A ₂ , 50A ₃ ,...) Are connected to the third network 80A to which the extended gateway device 40A is connected, and the extended gateway device 40B is connected to the third network 80A. A plurality of facility devices 50B (50B ₁ , 50B ₂ , 50B ₃ ,...) Are connected to the network 80B.

  Although not shown, the central monitoring device 20 includes a control device (consisting of a CPU (Central Processing Unit), a ROM (Read Only Memory), a RAM (Random Access Memory), etc.), an external storage device (for example, read / write). Possible non-volatile semiconductor memory, hard disk drive, etc.), input device (eg, keyboard, mouse, keypad, touch pad, touch panel, etc.), display device (eg, CRT or liquid crystal) Comprising a monitor, etc.), and a predetermined communication interface. The central monitoring device 20 controls each equipment device 50 (for example, an air conditioner, an illuminator, etc.) via the gateway device 30 and each extended gateway device 40.

  In the present embodiment, the gateway device 30 corresponds to a first gateway device, and each extended gateway device 40 corresponds to a second gateway device.

  Although not shown, the gateway device 30 and each of the extended gateway devices 40 are a control device (consisting of a CPU, ROM, RAM, etc.), an external storage device (for example, a readable / writable nonvolatile semiconductor memory or a hard disk drive). Etc.) and a predetermined communication interface.

  When the central monitoring device 20 performs an operation or operation status monitoring on the equipment 50, a predetermined message is output from the central monitoring device 20 onto the first network 60. The electronic message is converted by the gateway device 30 into a data format that can be processed by the extended gateway device 40, and then output on the second network 70.

  The telegram output on the second network 70 is converted into a data format that can be processed by the equipment 50 by the extended gateway device 40 specified by the telegram, and then output on the corresponding third network 80. And delivered to the equipment 50 to be processed.

  On the other hand, a message from each equipment device 50 is output on the second network 70 via the corresponding extended gateway device 40. The electronic message is converted by the gateway device 30 into a data format that can be processed by the central monitoring device 20, and then output on the first network 60 and delivered to the central monitoring device 20.

  In this way, the central monitoring device 20 passes through the first network 60 and the second network 70 via the gateway device 30 and each extended gateway device 40 to the desired third network 80. A message is sent, and a message sent from any of the third networks 80 to the first network 60 via the second network 70 is received. Realizes monitoring and other functions.

  In order to understand the operation status of this equipment management system, it is necessary to grasp the messages flowing on each network, that is, the input / output states of messages in the gateway device 30 and the extended gateway device 40, respectively. The network analysis device 10 simultaneously collects messages from the first network 60, the second network 70, and any one of the third networks 80, analyzes the collected messages, and associates messages between these networks. And a function for presenting the result to the operator.

  The network analysis device 10 has the same hardware configuration as the central monitoring device 20. In other words, the network analysis device 10 includes a CPU, a ROM, a RAM, an external storage device, an input device, a display device, a predetermined communication interface, etc., although none of them is shown. Each process (details will be described later) executed by the network analysis device 10 is realized by a CPU or the like executing a predetermined program stored in a ROM or an external storage device.

  As shown in FIG. 2, the network analysis device 10 functionally includes a first message collection unit 101, a second message collection unit 102, a third message collection unit 103, and a first storage unit. 104, second storage unit 105, third storage unit 106, message association unit 107, operation reception unit 108, display unit 109, and control unit 110 that controls these components, Is provided. The operation receiving unit 108 receives an input operation from the user and sends a signal related to the received input operation to the control unit 110. Under the control of the control unit 110, the display unit 109 displays a screen for user operation, a result of a message association process described later, and the like.

  As shown in FIG. 3A, the first message collection unit 101 includes a first message reception unit 1010 and a first message analysis unit 1011. The first telegram receiving unit 1010 is a telegram (first telegram) that flows on the first network 60, that is, a telegram transmitted from the central monitoring device 20 to the gateway device 30 (downstream of the first network 60). Direction messages) and messages transmitted from the gateway device 30 to the central monitoring device 20 (upstream messages of the first network 60) are collected. The first message analysis unit 1011 analyzes the message received by the first message reception unit 1010, and stores information about the received message (message information) according to the analysis result in the first storage unit 104. For example, the first message analysis unit 1011 analyzes the direction (up or down) of the message, the session identifier, the content of the command, and the like, and stores the results in the first storage unit 104 in chronological order.

  The 2nd message | telegram collection part 102 is provided with the 2nd message | telegram receiving part 1020 and the 2nd message | telegram analysis part 1021, as shown in FIG.3 (b). The second message receiving unit 1020 transmits a message (second message) that flows on the second network 70, that is, a message (second network) transmitted from the gateway device 30 to any one of the extended gateway devices 40. 70 downlink messages) and messages transmitted from any of the extended gateway devices 40 to the gateway device 30 (upstream messages of the second network 70) are collected. Similar to the first message analysis unit 1011 described above, the second message analysis unit 1021 analyzes the message received by the second message reception unit 1020, and stores the result (message information) in a second time sequence in time series. Stored in the unit 105.

  The 3rd message | telegram collection part 103 is provided with the 3rd message | telegram reception part 1030 and the 3rd message | telegram analysis part 1031 as shown in FIG.3 (c). The third telegram receiving unit 1030 includes one or a plurality of facilities from the telegram (third telegram) flowing on the third network 80 (80A, 80B,...), That is, the specific (analysis target) extended gateway device 40. A message transmitted to the device 50 (downward message of the third network 80) and a message transmitted from any of the facility devices 50 to the extended gateway device 40 to be analyzed (third network) 80 uplink messages). Similar to the first message analysis unit 1011 and the second message analysis unit 1021, the third message analysis unit 1031 analyzes the message received by the third message reception unit 1030, and the result (message information). Are stored in the third storage unit 106 in chronological order.

The first storage unit 104 and the second storage unit 105 store, for example, message information conforming to the BACnet described above, and the third storage unit 106 stores message information conforming to a vendor-specific communication protocol. Stored. Each message information is, for example,
"Message acquisition time + transmission destination address + transmission source address + extended gateway address + session identifier + response necessity flag + command (processing details)
+ Processing target class identifier + processing target instance identifier + processing target property identifier + processing target property value "
Etc., and the records are respectively stored in the first storage unit 104 to the third storage unit 106, and the first message collection unit 101 to the third message collection unit 103, respectively. There are as many messages as collected.

  Here, the first storage unit 104 to the third storage unit 106 do not need to be configured with physically different semiconductor memories or the like. Furthermore, the first storage unit 104 to the third storage unit 106 may be configured by the same semiconductor memory or the like and may indicate the same memory area. In this case, the identification information indicating which one of the telegram information on the first network 60 to the third network 80 side is the first telegram analysis unit 1011, the second telegram analysis unit 1021, and the third telegram analysis. What is necessary is just to make it add to each message | telegram information by each of the part 1031. FIG.

  In the present embodiment, the user connects any third network 80 to be analyzed and the network analysis device 10 before causing the network analysis device 10 to execute the network message association process described later. And That is, when the third network 80A is an analysis target, the network analysis device 10 is connected to the third network 80A, and when the third network 80B is an analysis target, the third network 80B. Connected to.

  Returning to FIG. 2, the electronic message association unit 107 executes processing for associating electronic messages stored in the first storage unit 104 to the third storage unit 106 (electronic message association processing). The processing result of the electronic message association unit 107 is displayed on the display unit 109 via the control unit 110.

  FIG. 4 is a block diagram illustrating a configuration of the message association unit 107. As illustrated in FIG. 4, the message association unit 107 includes a relationship analysis unit 171 and a mapping table 172. The mapping table 172 shows the correspondence between messages flowing from the start point (ie, on the first network 60) to the end point (ie, on the third network 80) and the message flowing from the end point to the start point. It is a data table defined using all or part. FIG. 5 shows an example of the mapping table.

  In the example of FIG. 5, “command (WriteProperty etc.) + Processing target class identifier (BO etc.) + Processing target instance identifier (xxyy01 etc.)” which is a part of the components of the telegram information on the first network 60 side, A correspondence relationship between “command (operation, etc.) + Processing target property identifier (operation / stop, etc.)” that is a part of the component of the telegram information on the third network 80 side is defined. In the present embodiment, the upper two digits of the processing target instance identifier (for example, “xx” in the case of “xxyy01”) indicate the device address of the extended gateway device 40.

  The association analysis unit 171 includes message information stored in the first storage unit 104 (hereinafter referred to as origin message information) and message information stored in the second storage unit 105 (hereinafter referred to as intermediate message information). .) And message information (hereinafter referred to as end-point message information) stored in the third storage unit 106 is executed (message association process). At this time, the relation analysis unit 171 first refers to the mapping table 172 to associate the start point message information and the end point message information. Then, the relation analysis unit 171 extracts intermediate message information corresponding to the message information based on the detection time (reception time) of the message corresponding to each of the associated start message information and end message information.

  FIG. 6 is a flowchart showing the procedure of the message association process. Note that there is no limitation on the execution timing of the message association process, and it can be arbitrarily started by a user such as an operator. For example, the network analysis device 10 may always execute the message association process during normal operation of the facility management system and output the result to the display unit 109, or only collect messages during normal operation. You may make it perform. In the latter case, when a problem or the like occurs, the message association process is executed according to the operation by the operator.

  In the following description, in order to facilitate understanding, a case where a request message (downward message) from the central monitoring device 20 to the facility device 50 is associated will be described as an example.

  The association analysis unit 171 obtains one record of starting point telegram information (P) whose content indicates a request from the first storage unit 104 (step S101).

  The association analysis unit 171 refers to the mapping table 172 using the acquired origin message information (P) as a key, and the message information of the message that is predicted to be output from the extended gateway device 40 onto the third network 80. The content of (predicted message information) is acquired (step S102). In the example of FIG. 5, when the content of the acquired message information (P) is “WriteProperty + BO + xxy01”, the content of the corresponding prediction message information that is predicted to be output on the third network 80 is obtained. Is “operation + run / stop”.

  The association analysis unit 171 searches the third storage unit 106 for end-point message information (R) that matches the content of the acquired prediction message information and that is later in time series than the start-point message information (P). Extract (step S103). Next, the relational analysis unit 171 determines the intermediate message information from the second storage unit 105 in time series after the start message information (P) and in time series before the end message information (R). (Q) is extracted (step S104).

  As described above, a series of messages in the down direction when the request message is transmitted from the central monitoring device 20 to the equipment device 50 (start message information (P), intermediate message information (Q), end message information (R). ) Is completed.

  For example, as shown in FIG. 7, the request messages p1 to p3 for the equipment 50 are sequentially output from the central monitoring device 20 to the first network 60, so that the messages q1 to q3 on the second network 70. A case will be described as an example in which messages r1 to r3 are detected on the third network 80. In this example, it is assumed that the message p1 (starting message information P1) and the message r1 (ending message information R1) are associated with each other.

  In the above case, the relation analysis unit 171 detects the message r1 from the detection time of the message p1 (that is, the reception time of the message p1 by the first message reception unit 1010 of the first message collection unit 101) (that is, the first message r1). Detected on the second network 70 (ie, the second message collection unit 102) within a time t1 until the third message reception unit 1030 of the third message collection unit 103 receives the message r1. Message information (intermediate message information) corresponding to the message (received by the second message receiving unit 1020) is extracted from the second storage unit 105. In this example, the relation analysis unit 171 extracts the intermediate message information Q1 corresponding to the message q1. As a result, the message p1 (starting message information P1), the message q1 (intermediate message information Q1), and the message r1 (end message information R1) are associated with each other.

  The control unit 110 causes the display unit 109 to display the message group (related message group) associated by the message association unit 107 with another related message group in an identifiable manner, for example, by color coding.

  In the above message association process, a plurality of end point message information may be extracted. In this case, the relation analysis unit 171 may extract the intermediate message information with the message detection time related to the last end point message information in time series as the message detection time at the end point.

  In addition, an extraction condition for the end-point message information may be further added. For example, the end-point message information related to a message detected on the third network 80 within a predetermined time from the message detection time (that is, the message transmission time of the central monitoring device 20) at the starting point (first network 60). Only the association target may be used. Alternatively, in the process of step S103 in FIG. 6, only the end point message information related to the message with the closest detection time to the detection time of the message related to the start point message information among the end point message information that matches the condition may be the target of association. Good.

  As described above, according to the network analysis device 10 according to the first embodiment of the present invention, a series of messages flowing on three different networks (first network 60, second network 70, and third network 80). Are not collected individually, but can be collected at once, and the collected messages can be associated with each other and immediately presented to the operator. Therefore, it is possible to greatly improve the efficiency of development and maintenance work of the equipment management system.

  In the present embodiment, the network analysis device 10 is connected to any one of the third networks 80 to be analyzed, but a plurality of third networks 80 (for example, the third networks 80A and 80B). ) May be connected. In that case, the network analysis device 10 can simultaneously collect messages flowing on the plurality of connected third networks 80.

  In the mapping table 172 shown in FIG. 5, a one-to-one correspondence is defined, but this is just an example. For example, it may be defined by a correspondence relationship such as one-to-many, many-to-one, or many-to-many.

  Further, in the mapping table 172, only the correspondence relationship of a message flowing in one direction (for example, a message in a downward direction from the start point to the end point) may be defined.

  In addition, the correspondence between the message flowing from the starting point (ie, on the first network 60) to the intermediate point (ie, on the second network 70) and / or the message flowing from the intermediate point to the starting point is expressed as a component of the message. The intermediate telegram information to be extracted may be further narrowed down by referring to the intermediate point mapping table so that a data table (middle point mapping table) defined using a part or all of the above is stored. In this way, by using the midpoint mapping table, it is possible to improve the accuracy of message association.

  Further, the mapping table 172 and the above-described intermediate point mapping table may be input to the network analysis apparatus 10 from another information processing apparatus or the like via a serial interface or a USB (Universal Serial Bus) interface. The user may directly input the contents of these tables to the network analysis device 10 via the operation reception unit 108.

  Alternatively, a plurality of types of request messages specified in advance from the central monitoring device 20 (or the network analysis device 10) at a timing that does not hinder actual operation, such as before the operation of the facility management system is started, The mapping table 172 is constructed by causing the network analysis device 10 to collect the messages on the first network 60 and the messages on the third network 80 each time the data is output on the first network 60. You may make it do. In addition, an intermediate point mapping table may be constructed by detecting a message on the second network 70.

  Furthermore, information corresponding to the contents of the mapping table 172 may be automatically created and updated in the network analysis device 10. In this case, as shown in FIG. 8, the message association unit 107 includes a relationship analysis unit 171, a mapping information estimation / learning unit 173, and a mapping information storage unit 174.

  In the electronic message association unit 107 having such a configuration, the association analysis unit 171 acquires electronic message information from the first storage unit 104 and the third storage unit 106, and uses the mapping information estimation / learning unit 173 to correspond to the electronic message. The relationship is estimated and learned, and the result is stored in the mapping information storage unit 174. For example, the mapping information estimation / learning unit 173 determines the protocol in the upper network (first network 60) and the following network (third network 80), the propagation / processing delay time of the gateway device 30 and the extended gateway device 40, and the like. Based on this, the correspondence of the message is estimated.

(Embodiment 2)
Subsequently, Embodiment 2 of the present invention will be described. In the following description, the same reference numerals are given to components and the like that are common to the first embodiment, and the description thereof is omitted.

  FIG. 9 is a block diagram showing a functional configuration of the network analysis device 10A according to the present embodiment. The network analysis device 10A has the same hardware configuration as the network analysis device 10 of the first embodiment. That is, the network analysis apparatus 10A includes a CPU, a ROM, a RAM, an external storage device, an input device, a display device, a predetermined communication interface, and the like, although not shown in the figure.

  As can be seen from FIG. 9, in the network analysis device 10 </ b> A, the first message collection unit 101 to the third message collection unit 103 in the network analysis device 10 of the first embodiment are the first message transmission / reception units 101 </ b> A to 101 </ b> A, respectively. 3, the message transmission / reception unit 103 </ b> A. Further, a test message generator 111 and a test message storage unit 112 are newly added.

  The network analysis device 10A has a function equivalent to that of the network analysis device 10 according to the first embodiment, and further has a function of outputting a test message (test message) on each network.

  The first message transmission / reception unit 101A performs the same processing as the first message collection unit 101. That is, the first message transmission / reception unit 101A transmits a message flowing on the first network 60, that is, a message transmitted from the central monitoring device 20 to the gateway device 30 (downward message of the first network 60). Then, a message (upward message of the first network 60) transmitted from the gateway device 30 to the central monitoring device 20 is received. Then, the first message transmission / reception unit 101A analyzes the received message, and stores information (message information) about the received message according to the analysis result in the first storage unit 104. Furthermore, the first telegram transmitting / receiving unit 101A, based on the request from the control unit 110, the corresponding test message stored in the test message storage unit 112 (that is, to be output on the first network 60). Are output on the first network 60.

  The second message transmission / reception unit 102A performs the same processing as the second message collection unit 102, and further corresponds to the request message stored in the test message storage unit 112 based on a request from the control unit 110 ( That is, a test message (to be output on the second network 70) is read out and output on the second network 70.

  The third message transmission / reception unit 103A performs the same processing as that of the third message collection unit 103, and further corresponds to the request message stored in the test message storage unit 112 based on a request from the control unit 110 ( That is, a test message (to be output on the third network 80) is read out and output on the third network 80.

  When the test message generation unit 111 receives a request to generate a test message from the control unit 110, the message information stored in the first storage unit 104 to the third storage unit 106 and the message association unit 107 A test message is generated using the mapping table 172 held by The test message generation unit 111 stores the generated test message in the test message storage unit 112 for each corresponding network.

  When receiving a test message generation instruction from the user via the operation reception unit 108, the control unit 110 requests the test message generation unit 111 to generate a test message. At this time, the control unit 110 receives and receives parameters for generating a test message from the user (designation of an output destination network, designation of an object, property, property value, etc.) from the user via the operation accepting unit 108. Parameters may also be supplied to the test message generator 111.

  When receiving a test message transmission instruction from the user via the operation reception unit 108, the control unit 110 responds to at least one of the first message transmission / reception unit 101A to the third message transmission / reception unit 103A. Request transmission of test message (output on the corresponding network).

  As described above, according to the network analysis device 10A of the present embodiment, since a test message can be generated and transmitted, it is possible to contribute to the development of the equipment management system and the significant efficiency of the maintenance work.

  When the test message generation by the test message generation unit 111 is completed, the control unit 110 immediately transmits a test message to at least one of the first message transmission / reception unit 101A to the third message transmission / reception unit 103A. You may request.

  Further, the test message generated by the test message generation unit 111 and stored in the test message storage unit 112 may be appropriately edited by the user via the operation reception unit 108.

  Alternatively, a test message generated by another information processing apparatus or the like may be input to the network analysis apparatus 10A via a serial interface, a USB interface, or the like and stored in the test message storage unit 112. Alternatively, a test message may be directly generated and stored in the test message storage unit 112 by an input operation via the operation reception unit 108 by the user.

  The present invention is not limited to the above-described embodiments, and various modifications can be made without departing from the scope of the present invention.

  For example, the present invention can be applied to an equipment management system including four or more different networks (that is, a plurality of intermediate networks (second networks)). In this case, what is necessary is just to make it the structure provided with the message | telegram collection part (message | telegram collection means) for the number of networks. Then, similarly to each of the above embodiments, using the mapping table that defines the correspondence relationship of the messages flowing at the end (starting point and end point), first, the messages detected in the end network are associated, and each intermediate network From the messages collected in step 1, a message that is later in time series than the message on the start side and earlier in time series than the message on the end point side may be extracted. Further, the above-described mapping table for intermediate points may be held according to the number of intermediate networks, and the accuracy of association may be increased by using the mapping table for intermediate points.

  Further, by applying the program executed by each of the network analysis device 10 of the first embodiment and the network analysis device 10A of the second embodiment to an existing personal computer (PC), the network analysis according to the present invention can be performed on each PC. It is also possible to function as a device.

  Such a program distribution method is arbitrary, for example, a computer-readable recording medium such as a CD-ROM (Compact Disk Read-Only Memory), a DVD (Digital Versatile Disk), an MO (Magneto Optical Disk), or a memory card. It may be stored and distributed in a network, or distributed via a communication network such as the Internet.

  Various embodiments and modifications can be made to the present invention without departing from the broad spirit and scope of the present invention. The above-described embodiments are for explaining the present invention and do not limit the scope of the present invention. In other words, the scope of the present invention is shown not by the embodiments but by the claims. Various modifications within the scope of the claims and within the scope of the equivalent invention are considered to be within the scope of the present invention.

  The present invention can be suitably employed in an equipment management system or the like installed in a building.

10 network analyzer 20 building management system, 30 the gateway device, 40A, 40B extended gateway _{device, 50A 1 ~50A 3, 50B 1} ~50B 3 equipment, 60 a first network, 70 a second network, 80A, 80B Third network 101 First message collection unit 102 Second message collection unit 103 Third message collection unit 104 First storage unit 105 Second storage unit 106 Third storage unit 107 message association unit, 108 operation reception unit, 109 display unit, 110 control unit, 111 test message generation unit, 112 test message storage unit, 171 association analysis unit, 172 mapping table, 1010 first message reception unit, 1011 first 1 message analysis unit, 1020 second message reception unit, 1021 second message analysis unit, 1030 third message reception 1031 third of the message analysis unit.

Claims (6)

A device for analyzing a network in a system including a first gateway device and a second gateway device,
A first message collection means for collecting a first message that is connected to the first network to which the first gateway device is connected and flows on the first network;
A second telegram collecting means for collecting a second telegram that is connected to the second network to which the first gateway device and the second gateway device are connected and flows on the second network;
A third message collection means for collecting a third message that is connected to the third network to which the second gateway device is connected and flows on the third network;
A mapping table in which a correspondence relationship between the first electronic message input to the first gateway device and the third electronic message output from the second gateway device is defined;
Referring to the mapping table, the first telegram collected by the first telegram collection unit is associated with the third telegram collected by the third telegram collection unit, and the associated first Based on the collection time of each of the electronic message and the third electronic message, the associated first electronic message and the third electronic message are further associated with the second electronic message collected by the second electronic message collecting means. A message association means,
A network analyzer characterized by that. Further comprising display means for displaying the result of the association by the message association means.
The network analysis device according to claim 1. An intermediate point mapping table in which at least a correspondence relationship between the first electronic message input to the first gateway device and the second electronic message output from the first gateway device is defined;
The message association means includes the intermediate point mapping table, the first message and the third message previously associated, and the second message collected by the second message collection means. Associate,
The network analysis apparatus according to claim 1, wherein the network analysis apparatus is a network analysis apparatus. A test message storage means for storing the test message;
A first message transmission unit that reads a test message corresponding to the first message from the test message storage unit and outputs the test message on the first network;
A second message transmission unit that reads a test message corresponding to the second message from the test message storage unit and outputs the test message on the second network;
A third message transmission unit that reads a test message corresponding to the third message from the test message storage unit and outputs the test message on the third network;
The network analysis device according to claim 1, wherein the network analysis device is a network analysis device. A method for analyzing a network in a system including a first gateway device and a second gateway device,
A first telegram collection step of collecting a first telegram connected to the first network to which the first gateway device is connected and flowing on the first network;
A second telegram collection step of collecting a second telegram that is connected to a second network to which the first gateway device and the second gateway device are connected and flows on the second network;
A third telegram collection step of collecting a third telegram connected to a third network to which the second gateway device is connected and flowing on the third network;
With reference to a mapping table in which a correspondence relationship between the first electronic message input to the first gateway device and the third electronic message output from the second gateway device is defined at least, Associating the first telegram collected in one telegram collection step with the third telegram collected in the third telegram collection step, and each of the associated first telegram and third telegram A message correlating step for further associating the associated first message and the third message with the second message collected in the second message collecting step based on a collection time;
A network analysis method characterized by the above. A program for analyzing a network in a system including a first gateway device and a second gateway device,
On the computer,
A first telegram collection step of collecting a first telegram connected to the first network to which the first gateway device is connected and flowing on the first network;
A second telegram collection step of collecting a second telegram that is connected to a second network to which the first gateway device and the second gateway device are connected and flows on the second network;
A third telegram collection step of collecting a third telegram connected to a third network to which the second gateway device is connected and flowing on the third network;
With reference to a mapping table in which a correspondence relationship between the first electronic message input to the first gateway device and the third electronic message output from the second gateway device is defined at least, Associating the first telegram collected in one telegram collection step with the third telegram collected in the third telegram collection step, and each of the associated first telegram and third telegram Based on the collection time, the associated first message and third message, and a message association step for further associating the second message collected in the second message collection step, are executed.
A program characterized by that.

Images